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Students do not have the right to 
attend school anonymously, but 
they do have a right to have their 
information protected and used 
responsibly by local and state 
education agencies. State boards 
can help their states strike this 
balance. 


When the Family Educational Rights and 
Privacy Act (FERPA) was first passed in 
1974, schools realized that they had a 
problem: Without ongoing consent from 
parents (or an applicable FERPA exception), 
they were unable to ask students to wear 
nametags, create programs for the school 
play, display the school honor roll on the wall 
or in the local newspaper, announce football 
player names at games, or create a school 
directory. Some schools asked whether this 
new privacy law even allowed teachers to 
Call students by their name in class, since 
technically FERPA did not allow schools to 
share personal information about a particular 
student even with other students. 


Congress quickly acted and adopted amend- 
ments that same year to create an exception 
to FERPA, known as the directory informa- 
tion exception,’ which permits all the activi- 
ties described above by allowing schools—at 
their discretion—to share with third parties 
student personal information that “would not 
generally be considered harmful or an inva- 
sion of privacy if disclosed” (box 1). There 
are some exceptions: Schools usually cannot 
refuse to provide directory information to 
military recruiters who request it.? Parents 
have the right to opt out of this sharing, and 
the school must provide parents with notice 
annually of their right to opt out. 


Unlike most FERPA exceptions, the disclo- 
sure of student directory information does 
not come with limits. When the school 


shares information with a third party, that 
third party can redisclose that information to 
anyone. This is mainly for practical reasons. 
As mentioned above, schools can use di- 
rectory information, for example, to create a 
program for a school play that lists partici- 
pating students’ names. However, as anyone 
could attend the play and get the program, 
the school has no way to control who gets 
this information. If a parent objects, they can 
opt out of directory information sharing, and 
the student will not be listed in the program. 


As concern over student privacy has grown 
during the past decade, parents and privacy 
advocates have urged schools not to disclose 
directory information without limitations. 
Schools may not realize that they may exer- 
cise discretion in responding to requests by 
third parties for student directory information. 


In 2017, data analyst Leah Figueroa sent 
email requests to 10 institutions of higher 
education asking for “a listing of student di- 
rectory information.” Three schools request- 
ed that she fill out a Freedom of Information 
Act (FOIA) request before she could receive 
the data (depending on the state, directory 
information may or may not be considered 
subject to state FOIA laws); two schools sent 
her a public link to their student directory; 
and one provided her with the records of 
22,006 of their students after she paid $50. 
Figueroa did not need to identify herself or 
provide a reason why she needed the infor- 
mation—even though sensitive information 
was shared with her, such as telephone 
numbers and email addresses.° She noted 
that, while most directory information 
requests are legitimate, coming from “re- 
searchers or other colleges seeking to recruit 
students—some are likely coming from 
predatory loan companies,” other “aggres- 
sive marketers,” or even a stalker seeking 
the “dorm address of a student.” 


To some, sharing contact information may 
seem innocuous. Yet four districts learned 
otherwise last fall when malicious hackers 
attacked their student information systems, 
used parent and student telephone numbers 
to text death threats to students, and posted 
student contact information online.° They 
tweeted, “With the student directory from 
[Johnston Community School District in lowa 
that] we released, any child predator can now 
easily acquire new targets and even plan 
based on grade level.” While in the past a 
PTA directory would be photocopied and only 
shared within a community, today this contact 
information is often available online instead. 


BOX 1. EXAMPLES OF 
DIRECTORY INFORMATION 


The U.S. Department of Education’s 
Model Notice for Directory Information 
suggests that schools designate the fol- 
lowing information as directory informa- 
tion in their annual notice to parents: 


student’s name; 
address; 

telephone listing; 
electronic mail address; 
photograph; 

date and place of birth; 
major field of study; 
dates of attendance; 
grade level; 


participation in officially recognized 
activities and sports; 


e weight and height of members of 
athletic teams; 


e degrees, honors, and awards re- 
ceived; 


e the most recent educational agency 
or institution attended; and 


e student ID number, user ID, or other 
unique personal identifier. 


OPTIONS IN FEDERAL AND 
STATE LAW 

Eliminating the directory information exception 
would make day-to-day school activities im- 
possible, but as it stands today, FERPA is not 
protective enough of the privacy of directory 
information. And the protections that do exist 
are not clear. Many schools do not know they 
can deny requests for directory information 
and redact sensitive information like telephone 
numbers, dorm addresses, or email addresses 
when state law requires that directory infor- 
mation be shared under a FOIA request. 


In FERPA’s amended 2011 regulations, the 
U.S. Department of Education (ED) made it 
Clear that schools do not need to solicit an 
all-or-nothing opt-out decision from parents 
or eligible students: “If a school has the ad- 
ministrative capacity, it may permit parents 
or eligible students to opt out of specific 
items it has designated.” In addition, schools 
can pick and choose which information they 
designate as directory information in the 
first place. ED noted that schools have an 
obligation to “minimize information released 
in directories to the extent possible because, 
since the enactment of FERPA in 1974, the 
risk of reidentification from such information 
has grown as a result of new technologies 
and methods.”” 


Some states are trying out different ap- 
proaches. Ohio has a long-standing law that 
does not allow schools to disclose directory 
information “to any person or group for 

use in a profit-making plan or activity,” 
though the state has also limited the ability 
of schools to refuse to disclose directory 
information to a range of officials. Maryland 
has a law limiting the disclosure of phone 
numbers and home addresses unless par- 
ents have given consent.° 


After a political candidate in Virginia inap- 
propriately used directory information to text 
students to encourage them to register to 
vote and volunteer for the candidate,"° a law 
was passed in 2018 that said parents could 
opt out of “any or all” directory information 
categories, and it does not allow physical 
addresses, telephone numbers, or email 
addresses to be disclosed without written 
consent." The Virginia law also exempts di- 
rectory information from the state’s FOIA law. 


Currently, FERPA doesn’t require that the 
opt-out notice to parents be proactive; just 
posting it in the student handbook or online 
is sufficient. Many schools choose to provide 
a proactive notice to parents with a form 
that allows them to opt out, but this is only 
a requirement in Maryland.'* Recently, more 
and more districts are adopting directory 
information opt-out forms that allow parents 
to not only opt out entirely but also choose 
who can receive directory information. For 
example, in Fairfax County Public Schools 

in Virginia, parents can choose whether or 
not the school can share directory infor- 
mation with school-related organizations 
like the PTA, state and county agencies, in 
photographs online or in the media, or with 
other students. They can also choose what 
directory information can be shared in the 
first place.'? However, almost half of districts 
have less than 1,000 students and therefore 
may not have the administrative capacity 

to allow these options. For those districts, 
simply limiting what information is designat- 
ed as directory information or not allowing 
information to be shared with those seeking 
to profit from it may be an easier lift. 


STATE BOARDS’ ROLE 

If states agreed that the definition or scope 
of the directory information exception should 
be narrowed, ED has previously noted that 
such a change would have to come through a 
FERPA amendment and not a regulation.” In 
May 2018, the National School Boards Asso- 
ciation adopted a resolution to advocate that 
Congress amend the definition of directory 
information to exclude “address, telephone 
listing, and date and place of birth.”"® 


State boards of education can lead on this 
issue. Thirty-six state boards of education 
have some legal authority over student data 
privacy, with 18 state boards specifically 
required to write their state’s data collec- 
tion policy.'* Even if state boards are not 
empowered to pass policies on this issue, 
they can raise awareness about the privacy 
issues that the disclosure of some direc- 
tory information raises and point to useful 
resources and potential ways forward. State 
boards can look at examples in legislation 
and district policy and determine the best 
way to protect student privacy while still 
ensuring that student names can be used 


in school play programs and announced at 
football games. 


Amelia Vance is director of the Education 
Privacy Project and policy counsel at the 
Future of Privacy Forum in Washington, DC. 
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